6 ms·

Okay, now if you really want to impress me, pretend you work for reddit and write some code that would catch this kind of script and give it "cheater" flair.

• natrius 12y ago
  Monkeypatch setInterval/setTimeout to mark people as cheaters. The more dedicated cheaters will hit the button API outside of the browser, which is pretty hard to stop.
  • Kurtz79 12y ago
    For someone with only limited HTTP/Javascript knowledge: "The more dedicated cheaters will hit the button API outside of the browser, which is pretty hard to stop" How this would be accomplished, I guess from the command line ? EDIT: found what Monkeypatch means.
    • tokenizerrr 12y ago
      The button presses are communicated over a websocket. You could make your own websocket client and communicate however you want to, such as listening to time updates and sending a click when it reaches a certain treshold.
  • tom-lord 12y ago
    Umm... What?? If you did this, then surely EVERYONE would be flagged as a cheater! Clicking the button "legitimately" would call the same function!
    • aidos 12y ago
      Monkey patching setTimeout / setInterval would allow you to detect when people were running timers on the page. Use of timers could generally be considered "cheating." It doesn't do anything to intercept people pushing the button. window.setTimeout = function setTimeout(fn, ms) { alert("No you don't, cheater!"); assign_button_color_of_shame(); original_setTimeout(fn, ms); }
      • tom-lord 12y ago
        Ohh right, so your plan would be to essentially check for third-party javascript things running on the same page? This would be a really easy "security" measure to circumvent, though - I could literally just delete your monkey patch, for a start!
        • aidos 12y ago
          It wasn't my idea so, no, that was never my plan :) Though, you do raise a valid point, so let's see how it plays out. setTimeout = function(){...} delete setTimeout // true - you've removed the patch window.setTimeout = function(){...} delete window.setTimeout // true - you've removed the patch window.constructor.prototype.setTimeout = function(){...} delete window.constructor.prototype.setTimeout // false - the patch is still there! I don't know about the hierarchy of the prototype chain up at this level but it seems to work. Maybe there's some other way of getting to the built-in setTimeout so you can create your own version to mask the one I added? EDIT you can embed an iframe and rip the native setTimeout from there.
          • zedadex 12y ago
            reddit stops you from embedding it iirc
            • aidos 12y ago
              I tried that too - you can just use any old page that has CORs headers allowing it.
          • towelguy 12y ago
            They could listen to the DOMSubtreeModified event in the 10s div.
            • aidos 12y ago
              Nice! There are probably clocks all over the place when you start looking around :)
  • DaFranker 12y ago
    Easy options for this are plentiful. [1] http://www.sikuli.org/ http://www.sikuli.org/
• evan_ 12y ago
  var cheaterFunc = function () { console.error('cheater!'); // report cheater to server somehow... }; $('*').each(function (i, el) { if (el instanceof Object) { Object.defineProperties(el, { innerHTML: {get: cheaterFunc}, innerText: {get: cheaterFunc} }); } }); ...and of course to defeat this, you could simply use a tampering proxy to prevent this javascript from making it to the browser. (There are probably other ways to get the value of each digit with javascript, but you should be able to just add cheaterFunc to each of those. .childNode, change the style to use a custom font where each number has a different, predictable width and test .offsetWidth, etc.)
  • girvo 12y ago
    Easier way to get around that: use a version of internet explorer that doesn't support getters!
• gravity13 12y ago
  Use a canvas element to render the timer.
• humanarity 12y ago
  People I think all these "cheater traps" are unimportant, because there's actually no "significant advantage" to using a robot. It isn't going to make you more likely to beat human players, only allow you to stay on there longer at lower cost to you. This is because two things: 1) the userbase size, and 2) the userbase behaviour. Because the userbase is so large, there's always going to be some people on there, meaning even with a robot you always have some competition. So the only thing a robot will allow you to do is potentially have better reaction times than a human, however, this is also invalid when you consider that it's likely people are not trying "hit" a particular countdown number they're "aiming for" but rather simply pressing the button when their "threshold" for waiting any longer is exceeded. Wit enough people this is probably well modelled by a random process, with clicks coming essentially randomly over time with some weighting to increase the closer you get to zero. So even a "reflex reaction" is not going to outbeat a horde of random clickers. The robot is really only competing with itself, how fast can it check and how fast can it click after determining the person it's working for's risk/reward utility threshold has been crossed? So having a robot to play for you is not going to allow you to cheat, only to spend your time dong something more constructive for humanity than clicking a button :) Maybe I'm missing something here, and I still don't see a way to cheat that actually has significant chance of beating others ! :)
  • Kiro 12y ago
    > So having a robot to play for you is not going to allow you to cheat, only to spend your time dong something more constructive for humanity than clicking a button In other words cheating since "normal" players need to spend their time doing that while you can have it on 24/7. I don't understand how you can say it doesn't make you more likely to beat human players. You increase your chances of getting the orange flair by magnitudes.
    • georgehotelling 12y ago
      That assumes that the goal of the button is to get as low of a flair as possible. It may not be the creator's intent.
    • habitue 12y ago
• zamalek 12y ago
  Inside the click handler for the button use `new Error().stack`. You should be able to determine if it's a legitimate event from the stack trace. Ultimately, though, someone could just use HTTP instead of monkeying about with scripting in the browser. You could only deter this by serving up a new JS file every day that has a new way to e.g. calculate a checksum on the button click. Ultimately people are going to find a way to cheat no matter what you do. If this is a social experiment that is a result, too.
  • DEinspanjer 12y ago
    What I'd probably do would be to have the JS in the button capture some user driven events such as mouse positions and click characteristics. If they had great foresight, they could have already been doing this for the previous 700k clicks. With a reasonably sized observation pool, they could compare subsequent clicks and detect outliers. I think it would be hard to circumvent since people attempting to reverse engineer wouldn't have the observation pool to know what signals Reddit admins were modeling. The biggest downside I can think of is that there would be some delay before calling out a cheater depending on the reliability of the model. The client side JS could detect the lack of an event capture payload and warn legitimate users after they unlock but before they click so they wouldn't be flagged due to browser incompatibility or JS restrictions from a security policy or privacy extension.
• Mahn 12y ago
  There isn't much you can do if the "cheating" happens client side, because the cheater has complete control there. At most you can obfuscate it by e.g. rendering the button in a canvas element and/or including a checksum and change the js files frequently like people here mention, but again, that will be just obfuscation, not real security.